{"cve":"CVE-2024-5550","nvd":{"published":"2024-06-06T19:16:09.473","modified":"2026-06-17T08:16:10.567","status":"Modified","description":"In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-22"],"references":["https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc","https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc"],"products":["h2o:h2o"],"source":"nvd","synced_at":"2026-10-19T21:51:20.603330631+00:00"},"epss":{"cve":"CVE-2024-5550","score":0.00835,"percentile":0.57706,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-x234-r5fg-x52m","url":"https://osv.dev/vulnerability/GHSA-x234-r5fg-x52m","summary":"Arbitrary system path lookup in h20","modified":"2026-07-07T17:56:31.085858093Z","packages":[{"ecosystem":"PyPI","name":"h2o","purl":"pkg:pypi/h2o","ranges":["<=3.40.0.4"],"fixed":[]}]},{"id":"PYSEC-2026-1446","url":"https://osv.dev/vulnerability/PYSEC-2026-1446","summary":"Arbitrary system path lookup in h20","modified":"2026-07-07T17:46:13.789733659Z","packages":[{"ecosystem":"PyPI","name":"h2o","purl":"pkg:pypi/h2o","ranges":["<=3.40.0.4"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}